Hack The Box: Overwatch

Fri, 22 May 2026 08:15:23 +0200
Enum:
mairon $ rustscan -a 10.129.232.128 --ulimit 5000 -- -Pn -n -v --open -A -sCV | tee rustscan.txt
.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.
| {}  }| { } |{ {__ {_   _}{ {__  /  ___} / {} \ |  `| |
| .-. \| {_} |.-._} } | |  .-._} }\     }/  /\  \| |\  |
`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'
The Modern Day Port Scanner.
________________________________________
: http://discord.skerritt.blog         :
: https://github.com/RustScan/RustScan :
 --------------------------------------
Port scanning: Making networking exciting since... whenever.

[~] The config file is expected to be at "/home/mairon/.rustscan.toml"
[~] Automatically increasing ulimit value to 5000.
Open 10.129.232.128:53
Open 10.129.232.128:88
Open 10.129.232.128:139
Open 10.129.232.128:135
Open 10.129.232.128:389
Open 10.129.232.128:445
Open 10.129.232.128:464
Open 10.129.232.128:593
Open 10.129.232.128:636
Open 10.129.232.128:3269
Open 10.129.232.128:3268
Open 10.129.232.128:5985
Open 10.129.232.128:6520
Open 10.129.232.128:9389
Open 10.129.232.128:49270
Open 10.129.232.128:49269
Open 10.129.232.128:49664
Open 10.129.232.128:49669
Open 10.129.232.128:51185
Open 10.129.232.128:59555
[~] Starting Script(s)
[>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -Pn -n -v --open -A -sCV" on ip 10.129.232.128
Depending on the complexity of the script, results may take some time to appear.
[~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-01-30 14:09 +0100
NSE: Loaded 158 scripts for scanning.
NSE: Script Pre-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 14:09
Completed NSE at 14:09, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 14:09
Completed NSE at 14:09, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 14:09
Completed NSE at 14:09, 0.00s elapsed
Initiating Connect Scan at 14:09
Scanning 10.129.232.128 [20 ports]
Discovered open port 135/tcp on 10.129.232.128
Discovered open port 445/tcp on 10.129.232.128
Discovered open port 139/tcp on 10.129.232.128
Discovered open port 49269/tcp on 10.129.232.128
Discovered open port 53/tcp on 10.129.232.128
Discovered open port 593/tcp on 10.129.232.128
Discovered open port 88/tcp on 10.129.232.128
Discovered open port 49669/tcp on 10.129.232.128
Discovered open port 6520/tcp on 10.129.232.128
Discovered open port 59555/tcp on 10.129.232.128
Discovered open port 464/tcp on 10.129.232.128
Discovered open port 51185/tcp on 10.129.232.128
Discovered open port 3268/tcp on 10.129.232.128
Discovered open port 9389/tcp on 10.129.232.128
Discovered open port 636/tcp on 10.129.232.128
Discovered open port 49270/tcp on 10.129.232.128
Discovered open port 3269/tcp on 10.129.232.128
Discovered open port 49664/tcp on 10.129.232.128
Discovered open port 389/tcp on 10.129.232.128
Discovered open port 5985/tcp on 10.129.232.128
Completed Connect Scan at 14:09, 0.02s elapsed (20 total ports)
Initiating Service scan at 14:09
Scanning 20 services on 10.129.232.128
Completed Service scan at 14:10, 53.79s elapsed (20 services on 1 host)
NSE: Script scanning 10.129.232.128.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 14:10
NSE Timing: About 99.96% done; ETC: 14:10 (0:00:00 remaining)
Completed NSE at 14:11, 40.11s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 14:11
Completed NSE at 14:11, 0.61s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 14:11
Completed NSE at 14:11, 0.00s elapsed
Nmap scan report for 10.129.232.128
Host is up, received user-set (0.012s latency).
Scanned at 2026-01-30 14:09:32 CET for 95s

PORT      STATE SERVICE       REASON  VERSION
53/tcp    open  domain        syn-ack Simple DNS Plus
88/tcp    open  kerberos-sec  syn-ack Microsoft Windows Kerberos (server time: 2026-01-30 13:09:39Z)
135/tcp   open  msrpc         syn-ack Microsoft Windows RPC
139/tcp   open  netbios-ssn   syn-ack Microsoft Windows netbios-ssn
389/tcp   open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: overwatch.htb, Site: Default-First-Site-Name)
445/tcp   open  microsoft-ds? syn-ack
464/tcp   open  kpasswd5?     syn-ack
593/tcp   open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
636/tcp   open  tcpwrapped    syn-ack
3268/tcp  open  ldap          syn-ack Microsoft Windows Active Directory LDAP (Domain: overwatch.htb, Site: Default-First-Site-Name)
3269/tcp  open  tcpwrapped    syn-ack
5985/tcp  open  http          syn-ack Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP)
|_http-server-header: Microsoft-HTTPAPI/2.0
|_http-title: Not Found
6520/tcp  open  ms-sql-s      syn-ack Microsoft SQL Server 2022 16.00.1000.00; RTM
| ms-sql-ntlm-info:
|   10.129.232.128:6520:
|     Target_Name: OVERWATCH
|     NetBIOS_Domain_Name: OVERWATCH
|     NetBIOS_Computer_Name: S200401
|     DNS_Domain_Name: overwatch.htb
|     DNS_Computer_Name: S200401.overwatch.htb
|     DNS_Tree_Name: overwatch.htb
|_    Product_Version: 10.0.20348
| ssl-cert: Subject: commonName=SSL_Self_Signed_Fallback
| Issuer: commonName=SSL_Self_Signed_Fallback
| Public Key type: rsa
| Public Key bits: 3072
| Signature Algorithm: sha256WithRSAEncryption
| Not valid before: 2026-01-30T13:07:29
| Not valid after:  2056-01-30T13:07:29
| MD5:     9826 167f cbfe db36 5da5 fd8e 9f1a c1f2
| SHA-1:   4872 b58e 57de 7612 b68f 6b1d 4115 5f8c 34b1 1ffb
| SHA-256: 0e6b 5f94 f6fe 4eb1 1941 b8ae 695e 0236 36d1 14f6 606f fff2 9feb dbe6 bda1 5793
| -----BEGIN CERTIFICATE-----
| MIIEADCCAmigAwIBAgIQYbYvmsvdZbhAzduf6y+mJjANBgkqhkiG9w0BAQsFADA7
| MTkwNwYDVQQDHjAAUwBTAEwAXwBTAGUAbABmAF8AUwBpAGcAbgBlAGQAXwBGAGEA
| bABsAGIAYQBjAGswIBcNMjYwMTMwMTMwNzI5WhgPMjA1NjAxMzAxMzA3MjlaMDsx
| OTA3BgNVBAMeMABTAFMATABfAFMAZQBsAGYAXwBTAGkAZwBuAGUAZABfAEYAYQBs
| AGwAYgBhAGMAazCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKeGw0S2
| vd0ffVmPJqilh3YzYf7jsZ3gSzaE2V3X3+UL57L4oqHmU1Kc2J4zl5iroS0bufuu
| pSf49BUJw4ih8rlVyjQpUh16kPDlVMekf+p32e1BdkjhkmvkHBWbfGna7qcLKg/p
| qQjQw5se6rm64v0g/HdD5keTtXsn87W5y0jmHg8IuEncgR4WVKfpEX9gg5//zohx
| Io4xE9d3O0X0zSGDkkWQq/BsBsrPfHy4x85k7hKPKyyvd56fQEGkGz9ogZgyMgqP
| hqbxZ6uXHeViyKhlq8XbrITYmveUTijFi8ub8tockNkf9hHib3PbtjGhN97990XH
| hUuO8+DyOCqQvvmPkFVvVaOFpMVh8jOpfLUzCxbXmHNYzYvroPlRyU2SG5XPwZMC
| EcISGbZDtdQk5DFxPOeBHLh2K8DfXCjUtAvQFkh3mqGUQr0ZwYVdhzY7FB3Cr0d9
| +kkub0VMpAi+01//BYSqsfwQRsdg90Gq+XKiNt1BV5oh/NdSGTcNMtl4gQIDAQAB
| MA0GCSqGSIb3DQEBCwUAA4IBgQCTJ6CQJUurIPrP3eOl96L7DgI/kkI23sZDCAim
| f5JWuQWcR3uncpDA+97Z+yaQ4FYkb2lyFsUM8Jhh78eijUsh1UJhs9uuCpQr3fQm
| ucbSkepGBuOJGtkrZlRO/ar6Pc2hUsJ0N+MJK79noMKxVzHm+x+0J+k5spq6SJW/
| QqT/uzHsSduOSt2m9s6DYlU3vaNXchLbIZVCqzaTdl7f/sbsjJLeTpkxml4n8Ct7
| vQjGCrPOV3JIkhv22zyfXN+5dAlDc/eYKpIyxnKpdBNGZI3GTroWxWt72u61fgcw
| kRUiPmzZjzmZXMw1c1h3njtU1fp/iq1+otPIYB0wrEsOhNJ3qU4JuYQ2mzmqq5Vi
| loLWBsNkb/PlFQvJWCrGNUI37sdtZGIk5aAAyiEikM7Ey/igMQYEKCQxNKAZwsnZ
| TjWoR+NeJqCN1AzaVYGRLA+Xs+8/D2vowFwDqQ0/tty7fRs+aEWjuCaYY83niitV
| y3Y8KkkewAL4hKc4HgAEV9K5EX8=
|_-----END CERTIFICATE-----
| ms-sql-info:
|   10.129.232.128:6520:
|     Version:
|       name: Microsoft SQL Server 2022 RTM
|       number: 16.00.1000.00
|       Product: Microsoft SQL Server 2022
|       Service pack level: RTM
|       Post-SP patches applied: false
|_    TCP port: 6520
|_ssl-date: 2026-01-30T13:11:07+00:00; 0s from scanner time.
9389/tcp  open  mc-nmf        syn-ack .NET Message Framing
49269/tcp open  ncacn_http    syn-ack Microsoft Windows RPC over HTTP 1.0
49270/tcp open  msrpc         syn-ack Microsoft Windows RPC
49664/tcp open  msrpc         syn-ack Microsoft Windows RPC
49669/tcp open  msrpc         syn-ack Microsoft Windows RPC
51185/tcp open  tcpwrapped    syn-ack
59555/tcp open  msrpc         syn-ack Microsoft Windows RPC
Service Info: Host: S200401; OS: Windows; CPE: cpe:/o:microsoft:windows

Host script results:
| smb2-time:
|   date: 2026-01-30T13:10:31
|_  start_date: N/A
|_clock-skew: mean: 0s, deviation: 0s, median: 0s
| smb2-security-mode:
|   3.1.1:
|_    Message signing enabled and required
| p2p-conficker:
|   Checking for Conficker.C or higher...
|   Check 1 (port 55945/tcp): CLEAN (Timeout)
|   Check 2 (port 57027/tcp): CLEAN (Timeout)
|   Check 3 (port 30386/udp): CLEAN (Timeout)
|   Check 4 (port 44208/udp): CLEAN (Timeout)
|_  0/4 checks are positive: Host is CLEAN or ports are blocked

NSE: Script Post-scanning.
NSE: Starting runlevel 1 (of 3) scan.
Initiating NSE at 14:11
Completed NSE at 14:11, 0.00s elapsed
NSE: Starting runlevel 2 (of 3) scan.
Initiating NSE at 14:11
Completed NSE at 14:11, 0.00s elapsed
NSE: Starting runlevel 3 (of 3) scan.
Initiating NSE at 14:11
Completed NSE at 14:11, 0.00s elapsed
Read data files from: /usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 94.68 seconds
Decompiling on Guido Kroon

Hack The Box: Overwatch
